Policy Server stops processing User Stores when user is disabled

Products

• CA Single Sign-On
• SITEMINDER

Issue/Introduction

Policy Server used to stop processing Authentication to other User Stores, once user disabled status is returned.

This behavior can be changed by setting a new Registry setting ReturnOnDisabledUser (1).

 

Resolution

There has been an addition to the registry setting 'ReturnOnDisabledUser'.

It will decide whether Policy Server will continue processing authentication to other User Stores if it encounters a disabled user.

1. Backup the registry;
2. Add the registry key:
   
   HKEY_LOCAL_MACHINE\SOFTWARE\Netegrity\SiteMinder\CurrentVersion\PolicyServer
   ReturnOnDisabledUser=                    0x1; REG_DWORD
     
   ReturnOnDisabledUser = 0x1:
   
   When the user is disabled in the first User Store, the Policy Server will not look into other configured UDs and declare them as 'Not Authenticated'.
   
   ReturnOnDisabledUser = 0x0:
   
   If the user is found disabled, the Policy Server will continue to look up through the other configured User Stores and mark the status as 'Not Authenticated' only if the usUser disabled in all User Stores.

 

Additional Information

 

1. Limit Policy Server Search to One User Store during Authentication